modules/duply_backup/default.nix

   1 { lib, pkgs, config, name, ... }:
   2
   3 let
   4   cfg = config.myEnv.backup;
   5   varDir = "/var/lib/duply";
   6   duplyProfile = profile: remote: prefix: ''
   7     GPG_PW="${cfg.password}"
   8     TARGET="${cfg.remotes.${remote}.remote profile.bucket}${prefix}"
   9     export AWS_ACCESS_KEY_ID="${cfg.remotes.${remote}.accessKeyId}"
  10     export AWS_SECRET_ACCESS_KEY="${cfg.remotes.${remote}.secretAccessKey}"
  11     SOURCE="${profile.rootDir}"
  12     FILENAME=".duplicity-ignore"
  13     DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'"
  14     VERBOSITY=4
  15     ARCH_DIR="${varDir}/caches"
  16
  17     # Do a full backup after 1 month
  18     MAX_FULLBKP_AGE=1M
  19     DUPL_PARAMS="$DUPL_PARAMS --full-if-older-than $MAX_FULLBKP_AGE "
  20     # Backups older than 2months are deleted
  21     MAX_AGE=2M
  22     # Keep 2 full backups
  23     MAX_FULL_BACKUPS=2
  24     MAX_FULLS_WITH_INCRS=2
  25   '';
  26   action = "bkp_purge_purgeFull_purgeIncr";
  27   varName = k: remoteName:
  28     if remoteName == "eriomem" then k else remoteName + "_" + k;
  29 in
  30 {
  31   options = {
  32     services.duplyBackup.enable = lib.mkOption {
  33       type = lib.types.bool;
  34       default = false;
  35       description = ''
  36         Whether to enable remote backups.
  37       '';
  38     };
  39     services.duplyBackup.profiles = lib.mkOption {
  40       type = lib.types.attrsOf (lib.types.submodule {
  41         options = {
  42           rootDir = lib.mkOption {
  43             type = lib.types.path;
  44             description = ''
  45               Path to backup
  46               '';
  47           };
  48           bucket = lib.mkOption {
  49             type = lib.types.str;
  50             default = "immae-${name}";
  51             description = ''
  52               Bucket to use
  53               '';
  54           };
  55           remotes = lib.mkOption {
  56             type = lib.types.listOf lib.types.str;
  57             default = ["eriomem"];
  58             description = ''
  59               Remotes to use for backup
  60               '';
  61           };
  62           excludeFile = lib.mkOption {
  63             type = lib.types.lines;
  64             default = "";
  65             description = ''
  66               Content to put in exclude file
  67               '';
  68           };
  69         };
  70       });
  71     };
  72   };
  73
  74   config = lib.mkIf config.services.duplyBackup.enable {
  75     system.activationScripts.backup = ''
  76       install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches
  77       '';
  78     secrets.keys = lib.flatten (lib.mapAttrsToList (k: v:
  79       map (remote: [
  80         {
  81           permissions = "0400";
  82           dest = "backup/${varName k remote}/conf";
  83           text = duplyProfile v remote "${k}/";
  84         }
  85         {
  86           permissions = "0400";
  87           dest = "backup/${varName k remote}/exclude";
  88           text = v.excludeFile;
  89         }
  90     ]) v.remotes) config.services.duplyBackup.profiles);
  91
  92     services.cron = {
  93       enable = true;
  94       systemCronJobs = let
  95         backups = pkgs.writeScript "backups" ''
  96           #!${pkgs.stdenv.shell}
  97
  98           ${builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (k: v:
  99             map (remote: [
 100             ''
 101               touch ${varDir}/${varName k remote}.log
 102               ${pkgs.duply}/bin/duply ${config.secrets.location}/backup/${varName k remote}/ ${action} --force >> ${varDir}/${varName k remote}.log
 103               [[ $? = 0 ]] || echo -e "Error when doing backup for ${varName k remote}, see above\n---------------------------------------" >&2
 104             ''
 105             ]) v.remotes
 106           ) config.services.duplyBackup.profiles))}
 107         '';
 108       in
 109         [
 110           "0 2 * * * root ${backups}"
 111         ];
 112
 113     };
 114
 115     security.pki.certificateFiles = [
 116       (pkgs.fetchurl {
 117         url = "http://downloads.e.eriomem.net/eriomemca.pem";
 118         sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 119       })
 120     ];
 121   };
 122 }